Veille CVE

Semaine du 12 octobre au 18 octobre 2026

2 CVE

Critique 0 Élevée 2 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « EnergizeLab NestJS auth service » ✕
  1. CVE-2026-105040 8.8 Élevée

    EnergizeLab NestJS auth service

    The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.

  2. CVE-2026-105034 8.2 Élevée

    EnergizeLab NestJS auth service

    The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.